The DFG JIT speculation failure code requires knowing the format in which values are stored on both the speculative, and non-speculative, paths. For example, a number may be either boxed, unboxed as an integer, or unboxed as a double. But sometimes the speculative JIT creates a speculation failure in which it fails to correctly set the data format of a register, leading to either incorrect speculation failure code, or assertion failures.
Created attachment 102564 [details]
Comment on attachment 102564 [details]
Clearing flags on attachment: 102564
Committed r92148: <http://trac.webkit.org/changeset/92148>
All reviewed patches have been landed. Closing bug.